The CCO’s Annual Report to the Board Showed Only Four Ethics Hotline Submissions Across 3,200 Employees Last Year. She Presented It as Evidence of a Healthy Culture. A Board Member Asked Whether It Might Mean Something Else Entirely.

Quick Answer

Is a low ethics hotline reporting rate evidence that a compliance program is working — or could it be evidence that employees don’t feel safe reporting?

It can be either, and without additional context, a compliance officer cannot determine which interpretation is correct by looking at the number alone. The 2024 DOJ Evaluation of Corporate Compliance Programs specifically asks whether low reporting rates reflect genuine compliance or a culture where employees are reluctant to come forward. Four submissions across 3,200 employees is statistically unusual in almost any organization — the question a mature compliance function asks is not “is this good?” but “do we understand why?”

2024 DOJ ECCP Connection

The 2024 ECCP asks prosecutors to evaluate whether a company’s program has created an environment where employees feel comfortable reporting concerns. It specifically addresses reporting rate analysis: a low rate is not automatically evidence of a healthy culture — it may reflect fear of retaliation, distrust in the process, lack of awareness of reporting channels, or a culture where concerns are handled informally and never reach the formal system. Prosecutors are trained to ask the same question the board member asked in this scenario.

The Situation

A CCO is presenting the annual ethics and compliance program metrics to the board of directors. The headline metrics are positive: 98% completion rate on annual training, three internal investigations completed during the year with appropriate outcomes, and an ethics hotline that received four reports across the company’s 3,200 employees. The CCO notes the low hotline volume as evidence that “employees feel their concerns are addressed by their managers before they need to escalate” and that this reflects the program’s emphasis on manager-level compliance conversations.

A board member — a former prosecutor — pauses on the reporting number. She asks: “How do we know that four reports means employees feel heard — rather than that they’ve learned not to speak up?” The CCO says she believes it reflects a healthy culture based on the manager conversation data. The board member asks what data the CCO has that would distinguish between those two interpretations.

The CCO does not have a ready answer.

Choice AStand behind the original interpretation. The high training completion rate and manager engagement data support the conclusion that employees feel heard. Four reports do not require further investigation — the board member’s concern is theoretical, and there is no specific evidence of a chilling effect.

Choice BCommit to a speak-up culture assessment — a structured effort to understand whether employees know how to report, feel safe doing so, trust the process, and have seen evidence that reports lead to action. Present the assessment methodology and timeline to the board at the next meeting. Use the findings to distinguish between a genuinely low-concern environment and a culture where concerns exist but aren’t being reported.

Choice CLaunch an immediate internal investigation to determine whether a chilling effect exists. Treat the low reporting rate as evidence of a compliance failure and investigate accordingly.

The Right Call

Choice B — A structured speak-up culture assessment.

Choice A defends a conclusion that the CCO cannot support with data, which is exactly the problem the board member identified. Saying the culture is healthy because training completion is high confuses inputs with outcomes: high training completion means employees attended training, not that they would feel safe reporting. Choice C treats an ambiguous signal as confirmed evidence and triggers a disproportionate response that could itself create anxiety and distrust. Choice B is the response that demonstrates compliance maturity: acknowledging the ambiguity honestly, committing to generating the data needed to resolve it, and presenting that process to the board as evidence that the compliance function asks hard questions about its own effectiveness.

Low reporting rates are genuinely ambiguous — and that ambiguity is the training moment.

A low reporting rate has at least four possible explanations: the organization genuinely has few compliance issues; employees with concerns are resolving them through manager conversations before formal escalation; employees don’t trust the reporting system enough to use it; or employees have learned through observation that reporting carries consequences. Only a speak-up culture assessment can distinguish between these interpretations. Presenting a low reporting rate as inherently positive without that context is not sophisticated compliance program management — it is avoiding an uncomfortable question.

Training completion rate measures inputs — not outcomes.

The 98% training completion rate indicates that 98% of employees completed a compliance training course last year. It does not tell them whether those employees can recognize a compliance issue, feel safe reporting one, or trust that a report would lead to meaningful action. The ECCP specifically distinguishes between activity metrics — completion rates, training hours, policy acknowledgments — and outcome metrics — whether the program actually changes behavior and creates a reporting-safe culture. The board member in this scenario is asking for outcome evidence. The CCO answered with input data.

“Managers handle it before it escalates” requires its own verification.

The CCO’s explanation that concerns are resolved at the manager level before reaching the hotline is a plausible and even desirable outcome for minor issues. But for serious compliance concerns — potential fraud, harassment, regulatory violations — informal manager resolution is not appropriate and may itself be a compliance failure. A compliance program that celebrates low formal reporting because managers are “handling it” needs to verify how managers are handling it, whether those resolutions are being documented, and whether any of those informal resolutions amount to burying rather than addressing concerns.

The board member asked the question every CCO should be asking themselves.

The CCO’s discomfort when unable to answer the board member’s question is the most important moment in this scenario. A compliance program that has not built the data infrastructure to distinguish between a genuinely healthy culture and a silenced one has a gap in its self-evaluation capability. The ECCP asks whether organizations monitor the effectiveness of their reporting channels. Monitoring effectiveness means having an answer to exactly the question the board member asked.

What does the 2024 DOJ ECCP say about compliance reporting rates?

The 2024 ECCP instructs prosecutors to evaluate whether an organization has created an environment where employees feel comfortable reporting concerns. It specifically addresses the risk that low reporting rates may reflect a chilled culture rather than a compliant one. Prosecutors are trained to assess reporting rate trends, investigate outcomes, treatment of reporters, and whether the organization has mechanisms to test whether employees feel safe reporting — not just whether a hotline exists.

What is a speak-up culture assessment and what does it measure?

A speak-up culture assessment is a structured evaluation of whether employees know how to report concerns, feel psychologically safe doing so, trust that reports will be handled confidentially and fairly, and have seen evidence that prior reports led to meaningful outcomes. It typically includes anonymous surveys, focus groups stratified by level and geography, analysis of reporting rate trends over time and by business unit, and review of how prior reports were handled and communicated back to the organization. The outcome is data that distinguishes between a genuinely low-concern environment and a culture of silence.

What compliance program metrics should a CCO present to the board alongside reporting rates?

Alongside reporting rates, a complete board presentation should include: reporting rate trends over time and by business unit (not just the current year absolute number); the proportion of reports that led to substantiated findings versus unsubstantiated ones; how outcomes were communicated back to the organization; any patterns suggesting post-report treatment changes; employee survey data on psychological safety and trust in the reporting system; and a comparison of reporting rates to external benchmarks where available. A single annual number without trend, context, or outcome data is not adequate for board-level oversight of compliance culture.

Is it appropriate for managers to resolve compliance concerns informally without routing them to the formal reporting system?

For minor interpersonal issues, yes — manager resolution can be appropriate and efficient. For serious compliance concerns — potential fraud, regulatory violations, harassment, safety issues, or retaliation — informal manager resolution is generally not appropriate and should be escalated to the formal compliance function. A compliance program that tracks how managers handle concerns informally — including what types of concerns are resolved at the manager level — has better visibility than one that only measures formal hotline reports. Informal resolution that substitutes for formal investigation on serious matters is itself a compliance risk.

How to Use This Scenario in Training

Recommended for CCOs, compliance program managers, board members with compliance oversight responsibilities, and senior HR leaders. This scenario is unusual in the Xcelus library because the audience is the compliance professional rather than the line employee — it trains the people responsible for program evaluation rather than the people subject to it. Particularly valuable for organizations preparing for DOJ ECCP review, conducting internal program assessments, or presenting compliance metrics to a board that is becoming more sophisticated in its oversight questions.

This scenario connects to the recognition principle at the core of the Decision Readiness Engine™: the board member recognized the ambiguity in a metric the CCO had presented as unambiguous. Decision-ready compliance leaders are trained to ask the harder question — not just “what does this number say?” but “what would this number look like if the opposite were true?” That question is what the ECCP now requires.

More Reporting & Non-Retaliation Scenarios

Want This Scenario in Your Compliance Program?

Xcelus builds scenario-based compliance training for CCOs, compliance managers, and boards — covering speak-up culture, reporting rate analysis, preparedness for ECCP evaluations, and the metrics that distinguish a healthy compliance culture from a silenced one.

View the Compliance Reinforcement Kit →
Contact Xcelus